- syslog-ng - lists.balabit.hu

interrogate daemon for parameter values?
by Matt Zagrabelny 30 Mar '15

30 Mar '15

Greetings, Is there a way to interrogate the running daemon to find out what the *effective* value is for things? For instance, I'd like to know what the effective value of so_rcvbuf is for a udp source. cat /proc/sys/net/core/rmem_default 1024 syslog-ng.conf: udp(); # uses default value of 0 service syslog-ng start echo 512 > /proc/sys/net/core/rmem_default Here is where I'd like to interrogate the running daemon and find that the udp driver is using a value of 1024 for so_rcvbuf. Any chance of doing that? Thanks! -m

2 1

[filter] unable to squelch annoying spam
by Robin Blanchard 28 Mar '15

28 Mar '15

Hi List, I've got some Solaris machines emitting some particularly annoying spam that I cannot seem to squelch. I've tried filtering on just about every MACRO that I can think might catch it, all to no avail. Here's the snippet from running syslog-ng in debug/foreground: # syslog-ng -Fdve 2>&1 |grep alloc_extra_sgl_frame Incoming log entry; line='<4>Mar 27 19:00:55 alloc_extra_sgl_frame failed' And here's the relevant filter bit (the other strings are doing their job). filter solaris_alloc { not ( match('alloc_extra_sgl_frame' value("MESSAGE")) or match('alloc_extra_sgl_frame' value("MSGHDR")) or match('alloc_extra_sgl_frame' value("FACILITY")) or match('alloc_extra_sgl_frame' value("PRIORITY")) or match('alloc_extra_sgl_frame' value("MSGID")) or match('ext-arq alloc fail.' value("MESSAGE")) or match('ext-arq alloc fail.' value("MSGHDR")) or match('/pci@0,0/pci8086,3c06@2,2/pci1000,3080@0' value("MESSAGE")) or match('/pci@0,0/pci8086,3c06@2,2/pci1000,3080@0' value("MSGHDR")) ); }; # syslog-ng --version syslog-ng 3.5.6 Installer-Version: 3.5.6 Revision: Compile-Date: Aug 13 2014 13:54:36 Available-Modules: affile,afprog,afsocket-notls,afsocket-tls,afsocket,afstomp,afuser,basicfuncs,confgen,cryptofuncs,csvparser,dbparser,linux-kmsg-format,syslogformat,system-source Enable-Debug: off Enable-GProf: off Enable-Memtrace: off Enable-IPv6: on Enable-Spoof-Source: on Enable-TCP-Wrapper: on Enable-Linux-Caps: on Enable-Pcre: on What else should I try? -- Robin P. Blanchard Nephila Advisors Infrastructure Administrator +1 615.823.8516 ext 4516 ---------------------------------------------------------------------------------- The information in this e-mail, and any attachment therein, is confidential and for use by the addressee only. Any use, disclosure, reproduction, modification or distribution of the contents of this e-mail, or any part thereof, other than by the intended recipient, is strictly prohibited. If you are not the intended recipient, please return the e-mail to the sender and delete it from your computer. This email is for information purposes only, nothing contained herein constitutes an offer to sell or buy securities, as such an offer may only be made from a properly authorized offering document. Although Nephila attempts to sweep e-mail and attachments for viruses, it does not guarantee that either are virus-free and accepts no liability for any damage sustained as a result of viruses. -----------------------------------------------------------------------------------

2 1

GSoC proposal: Python connector (maxvt)
by Max Timchenko 27 Mar '15

27 Mar '15

Dear all, I’ve posted a proposal for the Python connector at: https://github.com/balabit/syslog-ng/wiki/GSoC-2015-Proposal:-syslog-ng-for… Any comments are welcome. There are a few questions at the bottom; repeating them here for convenience: 1. Python 3, Python 2, or both? Supporting only 3 allows using nifty idioms and language features, but there are still users who prefer to speak 2. Constrained platforms may not have enough resources to run both. 2. Are there any priorities among the different components in the project? A total of 5 components are specified. 3. Viability of one-component-at-a-time approach — whether you would prefer to see each part as it is done to completion, or proceed in parallel for all components (eg., wrapper APIs for all, then Python APIs for all, then completed documentation and examples for all). Yours, — Max

2 1

GSoC 2015: Java Language Binding
by Garmine 42 25 Mar '15

25 Mar '15

Hi! I started coding coding around 6 years ago, first using Java and later extending my knowledge to many other languages including C, Python, FORTH, Active Oberon and Bash just to name a few of many. Right now I'm a student at Budapest University of Technology and looking for a challenge for the summer. Recently a friend of mine drew my attention to syslog-ng and so I started exploring the project. Not only because it's an important Unix application but also because I developed some logging utilities of my own and as a OSS user I would love to start paying back to the community using the knowledge I learnt from them. I am working on issue 257 at the moment and I study the code and infrastructure above all to truly understand what I'm doing rather than just copying functionality. (And sometimes figuring out configuration issues as Arch Linux doesn't seem to be the most popular development platform for syslog-ng :)) As I have significant experience in C and Java* I believe I could do the most if I worked to enable Java-Syslog interoperability. * I wrote OpenGL&CL experiments, an overly complicated BrainF#@k interpreter and contributed to a game called ScrumbleShip in C. I also developed a primitive web browser resembling the Line Mode Browser from scratch using an own HTML parser, a JSON parser, contributed to a Minecraft server's code and wrote many other smaller and larger programs in Java. Due to my interest in OpenGL I also gathered knowledge about JNI. (And I like to talk a lot!) Kind regards, Miklos Kozak

1 0

GSoC Syslog-ng WebSocket question
by Mohammadi, Mahmoud 25 Mar '15

25 Mar '15

Dear WebSocket Mentors, This is Mahmoud Mohammadi, a graduate student in UNC Charlotte, USA. Currently I am researching on GSoC syslog-ng ideas. In the WebSocket protocol, as you know there are different tasks and issues to consider such as initial handshaking, data exchange, data formats and ping/pong communication commands. So is it required to write a library for implementing the WebSocket protocol in C or C++ or just use an existing library( recommended by you or the programmer) to integrating it with syslog-ng for the required functionalities? And also can you please is there a rough estimation( if possible) about the variety of different data formats or commands exchanging between the server and client or they would be determined during the project? Sincerely, Mahmoud

1 0

[GSoC - 2015 Proposal] - Project: syslog-ng server monitoring with mobile app
by krish k 22 Mar '15

22 Mar '15

Hi all, I would like to propose a project. Mobile applications for server monitoring starting with Android and extending it to windows and iOS.I would like to discuss about the project with the mentor and would like to take this forward. Can someone kindly guide me in a correct direction to take this project forward. I am graduate student doing my Master of Computing at National University of Singapore - School of Computing. I have experience in Java, C, C#, Python. I have developed many android applications and published it in Google Play Store. Currently published apps can be found here https://play.google.com/store/apps/developer?id=Spaghetti%20Stack&hl=en I have worked with Verizon Inc before joining my masters, there I was working on a tablet application. I am very much thrilled about the idea of working with Syslog-ng community and be an active member. Looking forward to work on this project. Regards,Krishna.

1 0

GSoC 2015 WebSocket for syslog-ng
by Roland Lukács 22 Mar '15

22 Mar '15

Hello, My name is Roland Lukács and I am a third-year Computer Engineering student at Budapest University of Technology and Economics. I have experience in C, C++, Python programming languages. I'm system administrator in Schönherz dorm so I use often syslog-ng. I heard about GSoC from my friend who was part of it last year. I am interested in Websocket for syslog-ng project. I have already talked to László Mészáros, who told me about the project. Best regards, Roland Lukács

1 0

GSoC 2015: syslog-ng as a command line tool
by Máté Eckl 20 Mar '15

20 Mar '15

Hello, I'm Máté Eckl and I study IT engineering at the BME (I'm in my second semester). I studied C in the first semester, but I had prior experience with it. I also have experience on different programming languages, basics of networking (eg.: building a secondary DNS server for the college this spring), I use Linux (Ubuntu and Arch) and I'm familiar with getopt and the mechanism of command-line arguments. Earlier this semester I needed to prepare a basic syslog-ng configuration on a logging server, so I have slight knowledge about the system, but in the college I have great opportunity to get deeper inside it until the end of the semester. I'm really interested in this project, but the functionality is not really clear for me. What should the log messages be transformed to? Do you mean it to be a sort of debug session, where you can test the rules you want to apply in the config files? Or something else? Could you describe it to me a bit more precisely? Best regards, Máté Eckl

1 0

GSoC 2015 Python Language Binding
by Botond Borsits 19 Mar '15

19 Mar '15

Hello, My name is Botond Borsits and I am studying at Budapest University of Technology and Economics. I heard about the GSoC from my friend, who is a syslog-ng open source contributor. I am familiar with C and Python, so I would like to apply to the syslog-ng Python language binding project. Best regards, Botond Borsits

1 0

How to use @EMAIL@ parser in patterndb
by C. L. Martinez 19 Mar '15

19 Mar '15

Hi all, I have a situation like described in syslog-ng's docs (http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.7-guid…) about email addresses. I have tried to use "@EMAIL:email:"[<]>@ " in my patterndb to catch all possible email address combinations like <user(a)example.com>, [user(a)example.com] "user(a)example.com", as described in docs, but without luck. Every time that I check some log with pdbtool returns me errors about " [<]>" characters. I have tried to subsitute <> with < and >, for example, but nothing .... Any sample about how to use @EMAIL@ parser inside patterndb? I am using syslog-ng 3.5.x. Thanks.

2 1